ISO 27001 compliance Microsoft 365
Can you prove your controls worked in February, not just this week?
Certification runs on a three-year cycle - a stage 1 and stage 2 audit, then annual surveillance audits, then recertification - and the surveillance question is always the same: show that the controls operated all year, not that they exist this week. 1Security measures the tenant-side Annex A controls continuously - access rights, logging, supplier relationships, label protection - captures a dated snapshot every Monday, and exports a per-framework evidence pack, so the year is already on record when the audit is booked.
The scenario
Certification was the project. Staying certified is the job.
ISO/IEC 27001:2022 asks for a running information security management system, backed by 93 Annex A controls across four themes and a Statement of Applicability that says which ones you claim. Stage 2 checks that the design exists. The annual surveillance audit checks that it operated - and this is where programs bleed, because evidence assembled the week before the audit proves the control existed that week. The auditor asks for March.
Here is the arithmetic that makes the tenant side tractable: across eleven frameworks - ISO/IEC 27001 next to NIS2, GDPR, DORA and the EU AI Act - the obligations collapse into 15 shared requirements, 11 of them measured directly from tenant data and only four attested documents. The Annex A controls that live in Microsoft 365 are exactly the measurable ones: access rights (A.5.18), privileged access (A.8.2), logging and monitoring (A.8.15, A.8.16), supplier and cloud relationships (A.5.19, A.5.23). The incident-management controls A.5.24 to A.5.28 - planning, assessment, response, learning, evidence collection - are evidenced the same way: every detection carries a History & Comments trail written as the work happens and an Incident record generated from it, and the notification log shows alerting operated every week of the year. One fix moves ISO 27001, NIS2 and SOC 2 in the same pass.
And if you are not certified yet, the same evaluation answers the earlier question. Frameworks you have not adopted are measured anyway and shown with their own readiness percentage, so how close the tenant already is to certifiable is visible before anyone commits to the project - with deliberately conservative statuses, because not evaluated never counts as a pass. ISO/IEC 42001, the AI management sibling standard, sits in the same eleven and is scored by the same pass.
The walkthrough
From Statement of Applicability to evidence pack, on screens.
Each beat is a screen with a filter and an artifact at the end, not a workshop.
- 01
Open the ISO 27001 framework view
The Compliance screen scores the tenant against ISO/IEC 27001 control by control, in the order of the standard itself, each citing the shared requirements that satisfy it - with chips like "NIS2 ×2" showing what else a fix moves. The worklist orders every open requirement by how many articles it unlocks, and articles that changed since the last snapshot say what they changed from. Where you know the whole picture differs - devices managed in another tool, say - you record your own assessment with a note, and the measured status stays visible beside it.
- 02
Evidence the supplier controls
A.5.19 and A.5.23 ask how supplier and cloud relationships are governed. The Apps screen lists every OAuth app and integration with publisher, access channel and the admin who consented it. The Domains screen lists every external organisation seen in guests, shared files and mail, with its configured standing next to observed activity and contradictions flagged.
- 03
Answer access and logging from measurement
Open a requirement panel and the verdict comes with its numbers: dormant accounts against the 90-day window for A.5.18, sign-ins outside Conditional Access for A.8.2, log ingestion freshness and open critical anomaly episodes for A.8.15 and A.8.16, restricted files without a protecting label for the data controls. Next-step links land on the screen where each number lives. For A.5.26 to A.5.28, open any episode: the response actions, status changes and comments are already on its History & Comments tab, and the Incident record exports them.
- 04
Hand the auditor a dated year
Snapshots of the whole status document are captured every Monday and on demand, so "show me the state in March" has a real answer instead of a reconstruction. The per-framework evidence pack exports as a dated document and is served over the read-only REST API - the same artifact for the certification body, the internal audit and the board.
Будівельні блоки
Одне підключення лише для читання. Увесь стек Microsoft 365.
Кожен блок - це екран, який ваша команда відкриває в перший день. Кожен відповідає на запитання про власний тенант, на яке сьогодні ніщо в центрах адміністрування не відповідає.
Місцеположення
Звідки насправді надходить кожен вхід і кожна дія, на карті, по кожному тенанту. Порушення за місцеположенням, неможливі переміщення, списки дозволених по кожній людині. Працює без преміальних журналів входу.
Місцеположення
Звідки насправді надходить кожен вхід і кожна дія, на карті, по кожному тенанту. Порушення за місцеположенням, неможливі переміщення, списки дозволених по кожній людині. Працює без преміальних журналів входу.
Що для цього потрібно
Business Premium достатньо. Без агентів, без міграції, без E5 для старту.
1Security читає тенант, у якому ви вже працюєте, з вашими ліцензіями та вашою моделлю дозволів, за згодою лише на читання, яка займає хвилини. Нічого встановлювати і нічого мігрувати: він стоїть поруч із Entra, Purview, Defender та вашим SIEM і відповідає на запитання, які лежать між ними.
Історія активності зберігається до трьох років у ціні ліцензії, на будь-якому рівні, тож розслідування чи аудит мають запис без доповнення для зберігання.
Це ще й дешевший шлях. Більшість організацій купує потрібні контролі старшим рівнем Microsoft. З 1Security на стандартному рівні вони доходять туди приблизно на чверть дешевше, з більшою частиною виконаної роботи, на ліцензії, за яку вже платять.
- Business Premium достатньо
- Без вимоги E5
- Згода лише на читання
- 3 роки журналів у ціні
- Приблизно на 25% дешевше за ліцензійний шлях
- Наша хмара, ваша хмара, on-premise
What makes it work
Three parts of the platform behind the ISO 27001 answer.
The same 15 requirements score NIS2, GDPR, DORA and the EU AI Act in the same pass - one fix moves every framework that cites it.
Compliance monitoring
Eleven frameworks measured continuously from tenant data, with snapshots, a worklist and a per-framework evidence pack.
Explore the feature →Security score
Microsoft Secure Score beside the observed score, each control cross-referenced to the ISO 27001 articles it moves - so hardening work and audit evidence are the same list.
Explore the feature →Label coverage
Which restricted files actually carry a protecting sensitivity label - the measured half of the information-protection controls, counted file by file.
Explore the feature →
Microsoft Innovation Alley
Рекомендовано власною інноваційною програмою Microsoft.
Microsoft Innovation Alley співпрацює з 1Security і рекомендує його екосистемі, що відповідає на питання, яке проєкт з безпеки ставить першим: чи можна довірити вендору доступ лише для читання в тенанті, де лежать ваші дані.
Візьміть це на керівний комітет. Це відповідає на питання про довіру до того, як його поставлять.
FAQ
Common questions.
Does this get us ISO 27001 certified?
No - certification is issued by an accredited body after its own audit, and the ISMS covers people and processes beyond any tool. What 1Security does is evidence the Microsoft 365 slice of it continuously: the tenant-side Annex A controls as measured statuses with dated history, which is the material the surveillance audit spends most of its time on.
How much of Annex A does this actually cover?
The controls that are observable in the tenant: access rights, privileged access, logging and monitoring, supplier and cloud relationships, and information protection through labels. Physical controls, HR processes and systems outside Microsoft 365 need their own evidence sources. The evidence pack is honest about what it covers.
How do we evidence A.5.28, collection of evidence?
From the detection itself. Every anomaly or incident is an episode whose drawer holds the attributed activity in the incident window, the indicators drawn from it, the containment actions run through the Action Center and a History & Comments tab with every status change, severity verdict and comment, with who and when. The Report button turns that one detection into an Incident record in PDF, PowerPoint, HTML, CSV or JSON, and the generated report is itself recorded on the tab. The notification log on the Alerting screen adds what was sent, to whom, and what was withheld and why, kept for up to three years.
Do we need E5 licenses for this?
No. The measurement, the retained history and the evidence pack run on the standard read-only connection and the licenses you already own. Where a specific remediation does need a premium Microsoft SKU, the product says so on the action itself instead of letting you find out mid-fix.
We are mid-certification. Is this still useful?
That is the best moment to start. The snapshots begin accumulating the day the tenant is connected, so by the time stage 2 or the first surveillance audit arrives there is a dated record of the controls operating - and the worklist tells you which open gaps close the most articles before the auditor finds them.
What about ISO 42001?
ISO/IEC 42001, the AI management system standard, is one of the eleven frameworks the same evaluation scores - fed by the AI-side requirements like an accountable person per agent and captured agent instructions. If AI governance is on your certification roadmap, the readiness percentage is already on the screen.
Платформа 1Security
Відповідність ISO 27001 — це лише початок
Відповідність ISO 27001 — один екран платформи 1Security для Microsoft 365. Локації, пристрої, застосунки, ШІ-агенти, журнали, дозволи, чутливі дані, відповідність, звіти та дії працюють на тому самому підключенні лише для читання, на ліцензії, яку ви вже маєте.
- Дозволи та спільний доступХто до чого може дотягнутися, через яку групу, посилання чи гостя, і чи хотів цього хтось. Карта спільного доступу, яку запитує кожен аудит.
- Чутливі даніПерсональні дані, облікові дані, фінансові та медичні записи, знайдені нашими власними класифікаторами, з другою думкою Microsoft там, де вона в замовника є.
- Мітки конфіденційностіПокриття мітками та прогалини по сайтах і файлах, щоб захист, за який замовник заплатив, справді застосовувався.
- Файли, сайти та колонковий оглядачПереглядайте тенант як файлову систему: сайт, бібліотека, папка, файл, з дозволами та рівнем чутливості кожного рівня поруч. Проблема, розв'язана сама по собі.
- Користувачі, групи та життєвий циклНеактивні облікові записи, гості, які так і не пішли, групи з потрійною вкладеністю, осиротілі власники, адміністратори без MFA. Перевірка, яка всюди інде - таблиця.
- Зовнішні домениКожна стороння організація з точкою опори в тенанті, її довірчий статус, її дрейф і хто її запросив.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- Усі функціїПереглянути все
Walk into the surveillance audit with the year already recorded.
Connect read-only and the ISO 27001 control statuses, the worklist and the first evidence pack land the same day - and every Monday after that adds to the record.
Or keep assembling the binder the week before the audit.